2

I am trying to retrieve groups for a given MS Active Directory user using Java LDAP. When searching, I use the memberOf filter. The Default Users default group doesn't appear in the search results.

Is this expected? Are there any additional options I should use to get this group as well?

1 Answer 1

2

I am trying to retrieve groups for a given MS Active Directory user using Java LDAP. When searching, I use the memberOf filter. The Default Users default group doesn't appear in the search results.

Is this expected?

Yes, this is an expected behaviour. This is default domain group when the user is created/moved to the domain, and is called the PrimaryGroup.

This is a special group which every user is a part of by default, whenever he/she is added/moved to the domain.

Are there any additional options I should use to get this group as well?

If you want to read this using LDAP query, you can always query the user's PrimaryGroup attribute. It'd give you the value for the user as to which domain he belongs.

Sample query how you can achieve the same in Powershell is listed below:

Get-ADUser -Identity "<user-id>" -Properties * | Select sAMAccountName, PrimaryGroup
6
  • Thanks for you answer. Is the same true for other groups like Domain Admins?
    – superM
    Jan 15, 2018 at 15:24
  • @superM - I didn't get your question quite well! From what I understand, do you want to know if DomainAdmins Security Group is also a special group? Could you please rephrase your question? Jan 15, 2018 at 15:27
  • memberOf attribute returns the "Default Admins" group, which is a default group as well. I wanted to understand whether all the default groups aren't returned for this attribute, or "Default Users" is a special case.
    – superM
    Jan 15, 2018 at 15:29
  • @superM - I'm not aware of any "Default Admin" group which is present by default! You might have a custom security group created to which your current user is added to, which is named as Default Admin group. Did you mean "Domain Admins" Security Group? Jan 15, 2018 at 16:52
  • 1
    @superM - In my limited knowledge, I have only encountered this case for PrimaryGroup which is a DomainUser Group; other default groups are always listed if the user is a memberOf such groups. Jan 15, 2018 at 17:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .